SOC Alert Enrichment
Automate threat intelligence lookups for security alerts
Security analysts spend significant time manually researching IPs and domains in alerts. EdgeDNS automates this enrichment to accelerate investigation and response.
The Challenge
Security Operations Centers receive thousands of alerts daily. Each alert requires context: Who owns this IP? Is this domain legitimate? When was it registered? Manual lookups across multiple tools slow down investigation and response times, allowing threats to persist longer.
The Solution
Integrate EdgeDNS with your SIEM or SOAR platform to automatically enrich alerts with threat context. Get instant information about IP geolocation, ASN ownership, domain registration, and trust scores to prioritize and investigate alerts faster.
Endpoints Used
Combine these EdgeDNS endpoints to build this solution.
/v1/ip/geolocationTry in PlaygroundIP Geolocation: Identify IP location, ISP, and hosting provider
/v1/network/asnTry in PlaygroundASN Lookup: Get autonomous system information and ownership
/v1/domain/whoisTry in PlaygroundWHOIS Lookup: Check domain registration date and registrant info
/v1/score/trustTry in PlaygroundTrust Score: Assess domain/IP reputation and risk level
/v1/ip/reverseTry in PlaygroundReverse DNS: Resolve IP to hostname via PTR records
Results You Can Achieve
Reduce mean time to investigate (MTTI)
Instant context eliminates manual lookup steps
Improve alert prioritization
Trust scores help identify high-risk indicators quickly
Scale analyst capacity
Handle more alerts without adding headcount
Code Example
Enrich security alert with threat context
async function enrichAlert(alert) {
const headers = { 'Authorization': 'Bearer YOUR_API_KEY' };
const enrichments = {};
// Enrich IP indicators
if (alert.sourceIP) {
const [geo, asn, trust] = await Promise.all([
fetch(`https://api.edgedns.dev/v1/ip/geolocation?ip=${alert.sourceIP}`, { headers }),
fetch(`https://api.edgedns.dev/v1/network/asn?ip=${alert.sourceIP}`, { headers }),
fetch(`https://api.edgedns.dev/v1/score/trust?ip=${alert.sourceIP}`, { headers }),
].map(p => p.then(r => r.json())));
enrichments.sourceIP = {
country: geo.data.country,
organization: asn.data.organization,
trustScore: trust.data.score,
riskLevel: trust.data.risk_level
};
}
// Enrich domain indicators
if (alert.domain) {
const [whois, trust] = await Promise.all([
fetch(`https://api.edgedns.dev/v1/domain/whois?domain=${alert.domain}`, { headers }),
fetch(`https://api.edgedns.dev/v1/score/trust?domain=${alert.domain}`, { headers }),
].map(p => p.then(r => r.json())));
enrichments.domain = {
registrationDate: whois.data.created_date,
domainAge: whois.data.domain_age_days,
trustScore: trust.data.score
};
}
return { ...alert, enrichments };
}Learn More
Explore industry standards and best practices related to this use case.
Ready to build SOC Alert Enrichment?
Get started with 200 free API requests per month. No credit card required.